Operational Resilience

UK OperationalOperational Resilience

What is UK Operational Resilience?

UK Operational Resilience refers to a set of regulations and guidelines published by the UK financial regulators (PRA, FCA, BoE) to ensure digital operational resilience in the financial services sector.

Main Objectives:

  • Protecting the UK financial system from disruption to operations (e.g., cyber attacks, IT outages, natural disasters);
  • Safeguarding important business services and the interests of clients.

Fundamentally, UK Operational Resilience consists of a compilation of laws and policies imposed by UK financial authorities (PRA, FCA, BoE) to ensure operational resilience across the financial sector.

Key Requirements for Operational Resilience and Main Regulatory Papers

UK Operational Resilience directly references, and draws upon principles and concepts outlined in several key regulatory documents and standards. Here are some of the most important ones:

Supervisory Statements by UK Regulators:

  • PRA Supervisory Statement SS2/21: Operational Resilience: Details PRA expectations for regulated entities regarding the method for setting impact tolerances, scenario testing, and governance.
  • FCA & PRA Policy Statement PS21/3: Building Operational Resilience: Offers a comprehensive overview and more guidance, incorporating international norms.
  •  

Bank of England (BoE) Papers & Frameworks:

  • The Bank of England’s operational resilience framework (2018): Establishes the foundation with the introduction of important business services, impact tolerances, and scenario testing.
  • BoE Discussion Paper on Outsourcing and third-party risk management (2018): Stresses the management of risks from third party dependencies, which UK Op Res prominently addresses.

International Standards & Best Practices:

  • Basel Committee on Banking Supervision (BCBS) Principles for Operational Resilience (2021): Delivers worldwide directives for operational resilience structures that have impacted UK regulatory approaches.
  • The Financial Stability Board’s guidance on cyber resilience (2020): Is in tune with the UK model, underlining cybersecurity as a key part of operational resilience.

Other Relevant References

  • UK Government National Cyber Security Strategy: Deals with the general scope of cybersecurity threats, which underpins operational resilience rules for financial institutions.
  • Relevant industry standards (e.g., ISO 27001, NIST Cybersecurity Framework) could be drawn upon by firms in the creation of their operational resilience plans and in illustrating fulfillment.

Key Requirements of UK Operational Resilience:

  • Identifying Important Business Services: Financial institutions must define those services essential to their operations and the broader UK economic scheme.
  • Setting Impact Tolerances: Specifying the highest level of disruption that can be tolerated for each principal business service in terms of downtime or degraded performance.
  • Scenario Testing: Running thorough high-stress trials to simulate multiple presumable variables of disruption in order to ascertain ability to remain within impact tolerances.
  • Mapping and Risk Management: Pinpointing potential weaknesses and dependencies, such as third party engagement, and devising solutions for risk reduction.
  • Responsibility at Board Level: Responsibility for compliance and the embedding of the culture of operational resilience within the company rests with the board of directors.

Similarities and Differences with DORA:

Both DORA and UK Op Res frameworks place strong emphasis on operational resilience and proactive ICT risk management.
UK Op Res was introduced slightly earlier, with its first deadline passing in March 2022, while major DORA obligations will take effect from 2025.
There is significant overlap in the areas they cover, and both strive to harmonize operational resilience standards.

Why is UK Op Res Important?

  • Proactive Risk Mitigation: Helps financial institutions prepare for unforeseen events and reduce their negative impact.
  • Customer Protection: Ensures essential financial services continue to be available to consumers even during disruptions.
  • Financial Stability: Strengthens the UK financial system as a whole, making it more resilient to shocks.
  • Competitive Landscape: Firms demonstrating robust operational resilience gain an edge in the market.

WHO DOES IT IMPACT?

Asset Managers
Banks
Fintechs

How to comply with UK Operational Resilience?

1

End-to-End Strategic Support

Develop a customized operational resilience roadmap that reflects your individual business model, risk profile and the changing regulatory environment.
Instill robust governance, board-level accountability and metrics to measure progress.

2

Scenario Design & Testing

Developing rigorous, lifelike scenarios to simulate the full spectrum of operational disruptions (e.g., cyber attacks, natural disasters, third-party outages).Conducting tabletop and simulation-led exercises to validate an organization’s response plans and executive decision-making in a stressful environment.

3

Third-Party Risk Management (TPRM)

Perform extensive due diligence and continuous monitoring of key third-party suppliers for their resiliency and their effect on the company’s operations. Support in the negotiation of contractual clauses to guarantee that third-parties adhere to your operational resilience requirements.

4

Impact Tolerance Calibration

Work to define relevant impact tolerances for your key business services, considering customer expectations, regulatory obligations and your risk appetite.
Model the financial and reputational consequences of breaching impact tolerances.

5

Change Management & Culture

Emphasize embedding operational resilience throughout the organization’s culture, not just as a compliance exercise.
Develop change management strategies to drive buy-in and foster a proactive approach to risk identification and mitigation.

6

Data-Driven Insights

Leverage data analysis to map operational dependencies and potential vulnerabilities, informing your resilience strategy.
Establish operational resilience-specific dashboards providing continuous visibility into your risk posture.

Want to hire 

Regulation Expert? 

Book a call with our experts

Hire US